cve-suppressions.xml

<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<suppress>
   <notes><![CDATA[
	   This vulnerability only applies to using Spring Web as Server application.
   ]]></notes>
   <cve>CVE-2023-20860</cve>
   <cve>CVE-2023-20861</cve>
   <cve>CVE-2023-20863</cve>
</suppress>
<suppress>
   <notes><![CDATA[
	   This vulnerablility is not going to be fixed by Spring. Instead, it's an inherent insecurity of
	   Java Serialization, and the advice is not to rely on Java Serialization for untrusted data.
   ]]></notes>
   <cve>CVE-2016-1000027</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   Kotlin is only included as transitive dependency from okhttp, therefore both CVEs don't apply.
   ]]></notes>
   <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin\-.*$</packageUrl>
   <cpe>cpe:/a:jetbrains:kotlin</cpe>
   <cve>CVE-2020-29582</cve>
   <cve>CVE-2022-24329</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   A defect of DependencyCheck results in a false positive reported for json-java. This is not a dependecy, direct or
   transitive, of any Fahrschein module.
   ]]></notes>
   <cve>CVE-2022-45688</cve>
</suppress>
<suppress>
   <notes><![CDATA[
   This CVE is a false positive according to the Jackson project maintainers.
   See https://github.com/FasterXML/jackson-databind/issues/3972
   ]]></notes>
   <cve>CVE-2023-35116</cve>
</suppress>
</suppressions>